Searching Is Not Investigating: Tupac, Keffe D and the Retrospective Digital Footprint

I did not get into this space because I was interested in search engines, that's for sure.

A lot of what first pulled me towards intelligence work was gangs, organised violence and the culture that sits around it. Rap and hip-hop were always part of that picture. If you have spent any real time looking at gangs, particularly street gangs, you quickly realise that music is not something you can simply separate from the environment. It can tell you about identity, neighbourhoods, rivalries, friendships, reputations and sometimes conflict. It can also tell you absolutely nothing about criminality at all.

That distinction matters.

I have followed the Tupac Shakur murder for years, reaching out and engaging with experts like Greg Kading, partly because of my interest in hip-hop, but increasingly because of what the case represents from an intelligence perspective. Watching the Duane "Keffe D" Davis case finally reach a courtroom, almost thirty years after Tupac was killed, has been fascinating. Not because I think every interview, lyric or story should be treated as fact. Quite the opposite.

What fascinates me is how a murder committed in 1996, before the social media era, has accumulated an enormous information footprint in the years since. And now parts of that footprint are being tested in court.

Troublesome '96

Tupac was shot at the intersection between Flamingo and Koval in Las Vegas on 7 September 1996. He died six days later, very shortly after the death row entourage including lynchpin Marion "Suge" Knight and Mob Piru's had (everyone has seen the footage) stomped out a Southside Compton Crip by the name of Orlando Anderson ("Baby Lane"). The incident that led to that is another story, this was not just random.

There was no Instagram, no YouTube, no TikTok and no world of podcasts where people could sit for three hours discussing events from their past. There was no social graph for investigators to pull apart, no years of tagged photographs, no searchable archive of somebody's public statements, no hundreds of videos waiting to be transcribed and compared.

Investigators had what investigators had. Witnesses. Physical evidence. Intelligence. Interviews. Vehicles. Telephone records. Gang information. Whatever footage was available.

Then the case went cold.

But the information around it did not. That, for me, is where the case becomes really interesting. The crime scene stopped producing evidence. People did not stop talking.

Over the next thirty years, the Tupac case almost developed a second life. People gave interviews. Documentaries were made. Books were written. Old footage appeared online. Stories that had once circulated within Compton, Las Vegas, Los Angeles and the hip-hop world became globally searchable.

And ... Keffe D talked.

He spoke to investigators. He later spoke publicly. His account appeared in documentaries and interviews, and in 2019 he published Compton Street Legend, which included his version of what happened on the night Tupac was shot.

That creates an unusual investigative situation. The offence happened in an era where there was virtually no social media footprint. Yet one of the people alleged to have been at the centre of the events subsequently spent years creating one.

I think we need to start thinking about this as a retrospective digital footprint. Not the information somebody leaves behind while committing an offence, but the information they create about that offence afterwards. Sometimes years afterwards. Sometimes decades.

Murder Rap

One part of the Tupac investigation I have always found particularly interesting is the work involving former LAPD detective Greg Kading. Davis was interviewed in 2008 as part of an investigation involving Kading and a multi-agency task force.

There is an important point here, because these interviews are sometimes casually referred to online as confessions or sworn testimony. That is too simplistic. The interviews took place under a proffer arrangement, and the extent to which those statements could later be used has itself become a legal issue, Greg was very clear on this, which also can be heard in various platforms including the excellent documentary, Murder Rap.

That matters because context matters. It always does.

If somebody tells an investigator something under particular legal conditions, you cannot simply strip those conditions away twenty years later and treat the words as though they appeared in isolation.

The same applies to OSINT. Where did this information come from? Why was it said? Who was the audience? What did the person believe would happen to the information? Was it first-hand, or repeated from somebody else? Was the person trying to sell a book, build a reputation, protect somebody or simply tell the truth?

These are basic questions, but they are often forgotten when something appears compelling on a screen.

Life Goes On

This is the exercise I keep coming back to. Take exactly the same murder and investigate it with the tools and methods we have now. Not by pretending that Instagram somehow existed in 1996. Instead, look at everything that has accumulated since.

You could build a timeline of statements made across decades. You could compare what Davis told investigators in 2008 with what he said later. Compare documentary appearances. Compare interviews. Compare his book. Look at what remained consistent, and look at what changed. Establish what information was already public at the time each statement was made, and identify details that had not previously appeared publicly.

Then start layering relationships around it. South Side Compton Crips. Orlando Anderson. Death Row. Tupac. Suge Knight. The MGM Grand fight. The Cadillac. The BMW. The movements that followed. Witness accounts, contemporary gang intelligence, later statements.

You are no longer searching.

You are analysing.

And there is a very big difference between the two.

Can't C Me

This is probably one of the biggest problems I see in OSINT today. We have become incredibly good at finding things. That does not necessarily mean we have become equally good at understanding them.

Finding an Instagram account is not intelligence. Finding a photograph is not intelligence. Finding somebody in a music video, finding a lyric, finding an interview where somebody claims responsibility for something: none of that is intelligence either.

It is information.

The intelligence comes from what you do next. Can I corroborate it? What contradicts it? Who else independently says the same thing? Did they have access to that information, or could they have learned it from the media? Has their story changed? Is there another explanation? What confidence do I actually have in this assessment?

That is intelligence work. The tool is just helping you find the material.

It Ain't Easy

This same problem is now sitting at the centre of the debate around rap and drill music being used in criminal investigations and prosecutions.

There is a legitimate debate here. Lyrics, videos, social media posts, clothing, gang references, locations and associations have all appeared within criminal cases. Sometimes prosecutors argue that this material helps establish association, intent, knowledge or context. At the same time, there is understandable concern that investigators and courts can take artistic expression far too literally.

I think both sides of that debate can sometimes become too absolute.

A violent lyric does not make somebody violent. A drill artist talking about murder has not necessarily murdered somebody. Appearing alongside a gang member does not mean somebody is involved in that person's criminality. Wearing particular clothing does not prove gang membership, and using slang does not prove criminal association.

But equally, we cannot pretend that music and culture can never contain useful intelligence. Anyone who has actually worked around gangs knows that would be equally naive. There are occasions where music, videos and social media genuinely do reflect relationships, disputes or real-world events.

The important question is not whether we should ever look at it. Of course we should. The question is what evidential weight we give it.

All Eyez on Me

I have looked at enough gang material over the years to know how easy it is to build a convincing picture around somebody.

You start with a name. You find a video. Someone appears beside them. Then you identify a particular estate, a rival group gets mentioned, you find a photograph. There is a hand gesture. Somebody follows somebody else. A lyric seems to reference an incident.

Before long you have a graph full of connections. It looks impressive.

But what have you actually proved? Potentially very little.

This is where analysts have to be careful, because confirmation bias creeps in incredibly quickly. If you begin with the assumption that somebody is a gang member, almost everything they do can suddenly be interpreted through that lens. A friendship becomes an association. An association becomes a gang connection. A lyric becomes intent. A music video becomes evidence.

Eventually the intelligence product simply confirms the assumption that created it.

That is not good analysis.

Me Against the World

One of the best disciplines an analyst can have is actively trying to disprove their own assessment.

Could this relationship simply be social? Does the person actually live in that area? Is the terminology common across the genre? Who wrote the lyric, and has somebody else performed the same lyric? Was the supposed reference actually made before or after the incident? Is the alleged gang sign even a gang sign?

What evidence exists that does not fit the hypothesis?

That last question is particularly important. If every piece of information you collect confirms what you already believed, you should probably start asking harder questions.

Trading War Stories

This is where Tupac becomes such a useful case to think about alongside Rap on Trial.

With drill and rap prosecutions, one of the concerns is that fiction or artistic exaggeration can be interpreted as reality. With Keffe D, the argument potentially moves in the opposite direction. Here you have somebody who has repeatedly spoken publicly about a real murder, while his defence challenges how literally those statements should now be interpreted.

Was he describing reality? Was he exaggerating? Was he building his reputation, or selling books? Was he repeating things everybody already knew, or revealing information that only somebody close to the event could know?

Those questions sound remarkably similar to the questions we should ask when examining a drill lyric.

The context is completely different. The analytical discipline should not be.

Changes

We normally talk about social media as though its investigative value begins at the moment somebody creates an account. I think that is too narrow.

Social media, online video, podcasts and searchable digital archives have changed how we can investigate events that happened before any of those things existed. People who committed offences twenty or thirty years ago continued living. They subsequently created accounts, formed new relationships and discussed the past. They appeared in interviews. They wrote books. They argued with people publicly, responded to allegations, corrected stories. Sometimes they contradicted themselves.

That material can point backwards. For cold-case investigators, historians, journalists and intelligence analysts, that is incredibly powerful.

But it also creates risk.

A thirty-year-old murder can easily accumulate thirty years of mythology. Stories get repeated until people forget where they originated. One person's claim becomes another documentary's fact. A theory gets repeated across ten websites and suddenly appears to have ten sources.

It does not. It has one source repeated ten times.

Anyone conducting serious OSINT needs to understand that difference.

Ain't Hard 2 Find

Data provenance is particularly important now that AI can summarise enormous quantities of material.

An AI system can find fifty articles repeating the same claim. That does not mean fifty independent sources support it. It may mean fifty journalists copied the same original allegation.

The same applies to gang intelligence. If five intelligence reports all ultimately derive from the same anonymous source, you do not have five sources. You have one.

Understanding where information originally came from is fundamental. That is why provenance matters, and it is why simply giving analysts more data does not automatically result in better intelligence. Sometimes it just creates more noise.

Call It What You Want

I keep coming back to these three things because they are increasingly being blurred.

"Information is what we collect. Intelligence is what we assess. Evidence is what can ultimately be relied upon within an evidential process."
— Brett Redman, OSC

They overlap, but they are not interchangeable.

A screenshot can be information. After validation and analysis, it might contribute to an intelligence assessment. With the right provenance, authentication and legal context, it might later become evidence.

Even then, somebody still has to decide what that evidence means. That final part is judgement. And no search engine, graph database or AI model removes the need for it.

Ballad of a Dead Soulja

That is ultimately why I have found the Tupac case so fascinating.

Part of it is personal. I grew up interested in hip-hop, and the murder of Tupac has sat over that culture for nearly thirty years. But professionally, it represents something much bigger. It shows how an investigation can continue accumulating information long after the original event.

The crime happened in an analogue era. The investigation eventually entered a digital one. People who could not leave social media footprints in 1996 created them later. Interviews became searchable. Books became searchable. Documentaries became searchable. Old footage was uploaded, and claims could be compared across decades.

And now, almost thirty years after Tupac was killed, some of those words are being examined in a courtroom.

Whatever happens in the case against Keffe D "Duane Davis", there is a lesson here for anyone working in OSINT. The internet gives us access to more information than investigators at any other point in history. That does not remove uncertainty. It does not remove bias. And it certainly does not turn every public statement into fact.

The challenge is no longer simply finding information.

It is knowing what deserves to be believed.

That is the difference between searching and investigating. And increasingly, it is the difference between information, intelligence and evidence.